CBA hit with $3.55m fine and good-behaviour requirements after 65 million spam messages

The communications regulator said CBA was given ample warning but failed to resolve its emails.

The communications authority said the behaviour of CBA would be closely monitored. Picture: Damian Shaw

The Commonwealth Bank has been fined $3.55m by the communications regulator and forced to sign a three-year undertaking after it spammed customers with 65 million emails and made it difficult to unsubscribe.

The record penalty, the largest levied by the Australian Communications and Media Authority, comes after CBA failed to act despite being repeatedly alerted to the issues.

ACMA found CBA sent 61 million emails to customers, which “unlawfully required them to log-in” to unsubscribe.

A further 4 million emails were sent to customers without a “functioning unsubscribe facility”.

ACMA found CBA also sent almost 5000 messages to customers who had unsubscribed to its mailouts.

The Spam Act requires marketing messages to contain working unsubscribe options.

The act also generally bars senders to require users to log in to unsubscribe.

CBA has entered into a three year court-enforceable undertaking requiring the bank to commission an independent review of its marketing practices and “implement improvements”.

CBA must regularly report into ACMA about its improvements as well as train its staff on Australia’s spam laws.

ACMA chair Nerida O’Loughlin said marketing messages must make it easy to unsubscribe and said CBA’s breaches were concerning.

“The scale and duration of the breaches by the CBA is alarming, especially when the ACMA gave it early warnings it might have some issues and the steps it took were ineffective,” she said.

“The failure to fix the issues shows a complete disregard for the spam rules and the rights of its customers.”

Australian Communications and Media Authority chair Nerida O'Loughlin.

Ms O’Loughlin said the regulator was concerned that so many companies were failing to follow the Spam Act and consumers were frustrated by “marketing intrusions on their privacy”

“We continue to see large and well-known businesses who should know better than breaching the spam laws,” she said.

“This action is a further warning to all businesses that noncompliance with Australia’s spam laws will not be tolerated.”

ACMA has handed out $11m in fines during the past 18 months and a further 12 court-enforceable undertakings have been signed with it.

Ms O’Loughlin said the regulator would be “closely monitoring” CBA to ensure it complied with its undertakings.

“If we find future noncompliance, we will not hesitate to take further action,” she said.

CBA marketing and corporate affairs group executive Monique Macleod said the bank had fixed the issues that were subject of the ACMA complaint and had “strengthened our systems, processes and controls to support ongoing compliance”.

“CBA takes its Spam Act obligations very seriously and is prioritising its compliance with the EU,” Ms Macleod said.